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Abstract 



The Hermite Normal Form (HNF) is a canonical representation of matrices over any principal 
ideal domain. Over the integers, the distribution of the HNFs of randomly looking matrices is far 
from uniform. The aim of this article is to present an explicit computation of this distribution 
together with some applications. More precisely, for integer matrices whose entries are upper 
bounded in absolute value by a large bound, we compute the asymptotic number of such matrices 
whose HNF has a prescribed diagonal structure. We apply these results to the analysis of some 
procedures and algorithms whose dynamics depend on the HNF of randomly looking integer 
matrices. 
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1 Introduction 

j— i . 

Given a principal ideal domain R, the notion of Hermite Normal Form (HNF) of a n x m matrix 
with entries in R is well defined. When R = Z, which will be the case in this article, a matrix in 
■ HNF can be defined as follows, see e.g. [31 IT5] : 

h: 

Definition 1 (Hermite Normal Form (HNF)) A n x m matrix H with integer entries is in 
Hermite normal form if H is upper triangular with the following properties: 

1. The first r rows of H are the non-zero rows of H, 

2. for each row i, if h i j i is its first non-zero entry, then hij t > and j\ < j% < ... < j r , 

3. for each 1 < k < i < r, the entries hkj t of the jj column of H satisfy < hkj t < hij i . 
The positive integers hij t are called the pivot of the matrix in HNF. 

A row matrix is, up to a sign, already in HNF. We will assume in the sequel that n is at least 2. 
The main result about HNF, discovered by Charles Hermite, is that for all n x m integer matrix A, 
there exists a (possibly non- unique) unimodular n x n matrix U (i.e., U G GL„(Z)) and a unique 
n x m integer matrix H in HNF such that A = UH . The left equivalence between A and H means 
that there is a sequence of elementary row operations that will produce H when applied to A. Note 
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that the definition of the HNF can slightly change in the literature (e.g. lower triangular vs. upper 
triangular, column operations vs. row operations). Since the matrix H is uniquely defined, we 
can write without ambiguity H = HNF (A). Typically, the shape of a matrix in HNF will be the 
following: 





* 




0000000** 
00000000* 
000000000 
000000000 



The above example is given with (n,m,r) = (8,9,6) and the sequence ji of column positions 
of the pivots is 1, 2, 4, 5, 8, 9. As a matter of fact, only a very small proportion of HNFs of integer 
matrices has this type of shape. Anyone who had to compute the HNF of arbitrary integer matrices 
more than once was forced to observe that they do not appear "randomly" , that is, the elements 
hij i do not seem to follow an equiprobable law of distribution. For instance, the case ji = i and 
r = min(n, m) appears predominantly, and a strongly recurring structure is that all the pivots hij i 
with i < r are small and increasing with i (typically less than 10, even for matrices with very large 
entries) and the last pivot hij r is large (of the order of det A when n = m) . This particular point 
is intrinsically interesting, but was also used in several occasions (see e.g. [TJ [TSl [T5]) in order to 
heuristically understand or analyze the behavior of an algorithm. 

Our focus in this paper is set on the "probability" that the HNF of a random n x m integer 
matrix has a given diagonal. We aim to obtain an explanation of the strong biases mentioned above. 
For instance, Proposition [5] below gives the frequency of appearance of a given non-zero diagonal in 
the HNF of a randomly looking matrix. Proposition [5] also shows that the density of HNFs with 
the above shape is in fact 0. Corollary [7] shows that given strictly positive integers d\ 1 d,2 1 ...,d n _i, 
n > 2, the "probability" that a n x n integer matrix A has a HNF of the form 
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where d = ^ — d is given by 

(cw • c(« -!)■•■• c(2) ^r 1 ..... d^r 1 , 

where £ is the usual zeta function. Of course, the notion of "probability" and "density" used here 
have to be made precise. The appropriate concept is the notion of natural density, see e.g. |22) . 
Different definitions of densities appear naturally in analytic number theory with the study of prime 
numbers and expected values of arithmetic functions, see e.g. [22] and [9] for several examples. As for 
the natural density, the explicit multidimensional aspects of the question appear in e.g. \10\ 1131 114] 
and more implicitly in e.g. [1] |3l |4j |8j [11]. On the more specialized study of density of canonical 
form of matrices, let us mention the work of Evans [5] where the density of Smith normal form over 
the ring of integers of a local field is studied. The subject treated in the present article does not 
seem to have been the object of a publication in the past. 

The article is structured as follows. We address the question of a suitable definition of natural 
density in Z fe in Section [2] below. In Section [3] we present some results linking unimodular matrices 
and natural density of vectors. The main results of the article are stated and proved in Section [4] 
and in Section [5] we present some applications. 
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We will used the following notations. The set of primes in N* = N \ {0} is P, Landau's notations 
f(x) = o(x) and g(x) = 0(x) mean that lim^^oo f(x)/x — and limsupj.^^ \g(x)/x\ < oo. The 
Riemann zeta function ( is £(s) = Yl n >x n ~ S = IIpep(l — P _s ) _1 - The cardinality of a set 5" is \S\. 
We will also use the expression "randomly looking (integer) vector" in an informal way, meaning 
that the entries of the vector have been chosen uniformly at random in a large interval [-B, B[. The 
symbol * represents an integer whose value is unimportant depending on the context. 



2 Natural density in 1} 

In order to make the intuitive notion of probability in Z fe precise we first remark that the uniform 
distribution over Z fe or over even when k = 1, has little meaning. For this reason researchers 
often use the concept of natural density when stating probability results in N. In the following we 
briefly explain this concept. Let S C N be a set. Define the upper (respectively lower) natural 
density as 

- /riN ,. \sn\o,B\\ . \sn[o,B[\ 

B(S) = limsup - y — l - , B(S) = liminf ± l — — ^. 

B-s-oo B B^co B 

When both limits are equal one defines the natural density of the set S as 

D(S) :=D(S) =!(S). 

The notion of natural density allows to tackle questions related to the frequency of realization 
of events concerning randomly looking integers, i.e., for uniformly chosen integers in [0, B[, when 
B goes to infinity. A famous example in N is that the natural density of square free integers is 
6/ir 2 = C(2) _1 , see e.g. [9j. The extension of the above definition in higher dimension is sometimes 
implicit in the literature. For example the natural density of n coprime integers, equal to C(n) _1 , 
has been studied by several authors, starting with Cesaro in 1884 [4] (1881 for the case n = 2 
[21 [3]), Lehmer in 1900 jJJ] and Nymann [17]. For the historical fatherhood of the result see [14] . 
This natural density means that there are C(n) _1 • B n + o(B n ) n-vector in [0, B[ n whose entries are 
coprime. An explicit definition of a higher dimensional notion of natural density has been developed 
in e.g. [ini [T3j [14]. In these articles, the notion of natural density of a set S in Z k is defined as a 
"centered symmetric cube" version of the unidimensional definition, i.e., as the limit, when it exists, 
D(S) = lims^oo - — (2B) k ■ W e will however need a stronger definition. In order to see why, let 
us consider a set S in N with density S. Since \S (~l [0, Z[| = 5 ■ I + o(l), any interval [I, I + B[ with 
I = o(B) contains 5 ■ B + o(B) elements of S. Being able to estimate the local density in non centered 
cubes does not seem to be always possible in dimension k > 1 with the above definition of density. 
In order to achieve this, we require in the definition that the cubes can lie anywhere in Z fc . In the 
sequel, we call a cube any set of the form IliLiN — B, Zi + B[ k for some z £ l* k and B > 0. 

Definition 2 (Natural density in Z fe ) Let S be a subset of Z fe . If for all z £ Z fe , the following 
limit exists 

B(S) = hm I* nntx + I 

V ^ B^oo (2B) k 

and is independent of z, then it is called the natural density of S. 

Let us notice that it would have been even possible to extend the definition of natural density 
from Z to Z fe by using k- rectangles instead of cubes (i.e. different Bi for each dimension) . However 
both definition are equivalent since rectangles can be decomposed into smaller cubes. We will not use 
this property in the sequel. Another direction of generalization is the spherical model. This setting 
considers centered n-balls instead of n-cubes. Due to the symmetry of the balls around the origin, it 
is a natural choice in the study of different asymptotic results concerning lattices, integer matrices, 
and varieties in general see e.g. [161 119] . This model suffers however from the same problem as 
noted before and from the fact that the entries of the different objects of study are not independent 
anymore, i.e., the "random looking aspect" is somehow lost. 
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In order to prove our main results, we will need the existence and the value of the natural density 
of tuples of integers whose greatest common divisor is a given positive integer d. This is treated in 
Lemma [3] below. As mentioned in the introduction, in the weaker form of density definition given 
above, this problem has been studied by several authors, see e.g. [41 111). 



Lemma 3 When k > 2, the set {(xi,.. 
d k )-\ 



,Xk) G Z fc : gcd(xi) = d} has a density equal to (C(fc) 



Proof: Let ieZ fc and S — {(x\, ...jiJeZ' : gcd(xi) = d}. Then x G S if and only if Xi/d € Z 
and gcd(xjd) = 1. Let z[ = zjd, B' = B/d and S' = {(xi, . . . ,x k ) G Z fc : gcd(x{) = 1}. The first 
equality of the following equations is straightforward. 



Snf[[zi-B,zi+B[ 



S'nf[[z f i -B f ,zi + B'[ 



s'nf[[-B',B'[ 



i=l 



o(B k 



(1) 



In order to prove that the second equality of Eq. (fTJ) is valid, consider an element (x\, . . . , Xk) in the 
set of the left hand side of the equality. Let us fix all the components but the i th one, and consider 
t = gcdj^^Xj). The integers x±, . . . , Xk are coprime if and only if xi has no common factor with t. 
So if P is the set of prime divisors of t, both the interval \z\ — B',z[ + B'[ and \—B',B'[ contains 
2B' Yiptp — ^) + o(2B') integer coprime to the fixed Xj. This shows that the error resulting in 
setting Zi = in the mid term of Eq. (JXJ) can be adjusted by o(B') = o(B). Taking into account the 
effect of all dimensions together leads to the correction term o(B k ). Now, as mentioned before, see 
e.g. [Hiri!], we have 



which leads to 



B(5) 



lim 



s'nY[[-B',B'\ 



|snntifo--B,*« + -B[| 

(2B) k 



C(k)- l (2B') k +o{{B'Y) 



i\k\ 



Una 



C{k)' 1 (2B') k + o((B') k ) 
(2B) k 



«(k)-d k y 



□ 



3 Generalities on unimodular matrices 

Recall that a nxn matrix U with coefficient in Z is unimodular if its determinant is ±1. Unimodular 
matrices play a special role with respect to sets with densities as shown in the next lemma: 

Lemma 4 Let S C Z™ be a set with density 8 > and let V be a n x n unimodular matrix. Then 
V(S) = {Vx : x G 5*} has a density equal to 5. 

Proof: Given a cube a = n"=i[ z i — B, Zi + B[ in Z", let us count the number of points of the set 
V(S) that lie inside a. Since V is a bijection, this number is exactly the number of elements of S 
inside V~ 1 (a). The map V~ x is linear, and thus V~ 1 (a) is a n dimensional parallelepiped whose 
boundary <9U _1 (cj) is a union of parallelepipeds of dimension n — 1. Let us cover V^ 1 (a) with a 
disjoint union of N cubes of side length Bq with Bq = o(B), where Bq is an unbounded function of 
B, e.g. Bo — ln(£>). We would like to have an estimation for N. Since V is unimodular, the volume 
of V^ 1 (a) is (2B) n (in terms of Lebesgue measure). The disjoint union of cubes of side length Bq 
meeting the border has a total volume which behaves like 0(BoB n ^ 1 ). Taking into account this 
border effect, we therefore have (see Figure 1) 

AT _ (2B) n + OiBoB"- 1 ) 
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Figure 1: The border effect on V' 1 ^) 



Each of the cubes of side length Bo contains SBq + o(Bq) points of S. Therefore, 
|5- nV-V)l = N -(SBi; +o{B , l )) + O(B Q B n - 1 ) 

= S(2B) n + 0{B Q B n - 1 ) + ((2B) n + 0{B Q B n - 1 )) ■ - 




Finally, using the conditions on B , we see that 



lim 

B— >oo 



\v(S)na\ 

(2B) n 



= lim 

B— s-oo 



isny- 1 ! 

(2B) n 



= 6 



which finishes the proof of the lemma. 



□ 



The previous lemma can be used to prove that unimodular matrices keep invariant the density 
of vectors with entries of given greatest common divisor. More precisely, we have the following 
proposition. 

Proposition 5 Let U G Z nx ™ be a unimodular matrix and d G N*. Then, for any integer 2 < k < n, 



Proof: Consider S — {(j/i, . . . , y n ) G 27 1 : gcd(yi : i = n — + ...n) = d}. Because of LemmaH 
above, one readily checks that the set S has a density equal to (C(k) ■ d k )~ 1 . The result follows by 
applying Lemma 2] with U — V^ 1 to S since 



4 Distribution of Hermite normal forms 

We start this section by noticing that the pivots h i j i of the HNF of a matrix A are determined by 
the greatest common divisor of the i x i minors of the matrix that consists in the jf h columns of A, 
for I = 1, . . . , i. This is true because these gcd's are left invariant when A is multiplied on the left 
by any unimodular matrix, and because the gcd of the i x i minors of the matrix that consists in 
the jf 1 columns of the HNF of A, for I = 1, ... , i, is precisely equal to Yii=i i ^ij, ( an the other 
determinants are zero due to the shape of the HNF of A). Note that when ji = i the above minors 
are simply the i x i minors of the first i columns of A. 

This property can be used as a basis of a basic algorithm to compute the HNF of A. We start by 
computing the greatest common divisor h\ of the entries of the first non-zero column of A. Using 



P(x G Z" : gcd((J7a;) i : i 



n - k + 1, . . . ,n)) = d) = (C(fc) • d k ) 



,k\-i 



{x G Z" : gcd((Ux)i : i = n - k + 1, . . . , n)) = d} = {x G Z" : Ux G S} = V(S). 



□ 
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the extended Euclidean algorithm we can express h\ as a linear combination of the entries of the 
column. In a matrix form, this means that there exists a sequence of row operations, i.e., there 
exists a unimodular matrix U\, such that the first non-zero column of XJ\A is [h\,0, . . . ,0]*. This 
process can be repeated recursively as follows. There exists a unimodular matrix Uk such that the 
first k columns of UkA form a matrix in HNF, as follows: 



U k A = 



x\ * * * * 



x. 



(2) 



Let [*,...,*, xi, ... , Xs] 1 be the (k + l)-th column of UkA. If xi = 0, i = I, . . . , s, then this 
column is disregarded. The next column for which one of the Xi is non-zero is selected. Using 
the previous remark, the next pivot is given by hij i — gcd(xi), and using elementary row 
operations, there exists a unimodular matrix Uk+i such that the corresponding column of Uk+iA 
is [*,..., *, hij t , 0, . . . , 0]*. Appropriate elementary row operations can modify Uk+i and force the 
* elements of the column to satisfy the conditions of the HNF, i.e., to belongs to [0, ft-^J. At the 
end of the process, the resulting matrix is clearly in HNF and must therefore be HNF (A). This 
algorithmic approach will be useful in the proof of Proposition |6] below. The key point is that we can 
construct the HNF of A column after column, from left to right, via a sequence of left multiplications 
by unimodular matrices. 

In order to simplify the statement of our results, let us use the following notation. For any nxm 
matrix A, the diagonal diag (^4) of A is the list of elements (a^) i=li ... im i n (n,m)- For given n and m, 
if di, d%, dk are integer, we write 

A dud2 _ dk = {AeZ nxm : diag (HNF (A)) = (d u ...,d k , *,...,*)} 

whenever k < min(n, m). 

Proposition 6 Let n,m,k be positive integers and let di,d%, ...,<ifc £ N . 
1. Suppose n, m, k satisfy k < m if m < n and k < n otherwise. If dk = 0, 



,...,d, 



,) = o. 



If di 7^ 0, Vi = 1, k, then 



' (A,/.,/ ; . , i = (C(n) • C(n - 1)... • C(n - k + 1) • d? • d^ 1 



■ d n k - k+1 ) 



2. Suppose n < m and let < r < d £ N. Then 
B (A e A dud2t ... tdn _ ua : a = r 



mod d) = - ■ D (Ad li d ai ...,d n _ 1 ) . 



The first point of the previous proposition clearly shows that the example of HNF given in the 
introduction (with a in the diagonal) will only rarely appear. The powers appearing in 

the expression of the density explain the decreasing expectation to see a randomly looking nxm 
matrix having elements on the top of the diagonal of its HNF larger than 1. Let us now prove the 
proposition. 

Proof: We prove by induction on k that the expressions for the density are valid. For k = 1, we 
know that d\ is the greatest common divisor of the entries of the first column vector. If d± = 0, 
there is only one possibility for this column, giving a density equal to 0, and when d\ ^ 0, the claim 
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is the result given by Proposition [5] above, when U is the identity and with k — n. The induction 
step is as follows. For a bound B, the number of n x (fc — 1) matrices A' with entries in a cube of 
side length 2B such that diag(HNF {A 1 )) = (d%, ...,<2 fc _i) with di ^ 0, i = 1, . . . , k - 1 is 



(2£)n(fc-i) . . £(„ _ i)... . £(„ - jfc + 2) • dj • dj" 



o(B 



i(fe-i) 



For each of these matrices, there exists an n x n unimodular matrix U such that UA' is upper 
triangular and diag (UA') = (di, dk-i)- If v is a vector in Z n , then 







* : 
rf fe _i (C/w)fe_i 
(Uv) k 







Based on the algorithmic description of the HNF given earlier, the diagonal of the HNF of [A'\v] is 
(di,...,dk-i,dk), with d k = gcd((Uv)i : i = k,..., n)). Ud k = 0, we have v = ?7 _1 [*, ...,*, 0, ... , 0]*, 
i.e., there are only (2B) k ~ 1 such v in any cube a of side length 2B and dimension n, independently 
from U. Since n > k, this implies that D (Adi,da,...,o) — 0- Suppose now d k ^ 0. Using Proposition 
[SI we see that for each A\ there are (25)™ ■ (£(n - fc + 1) • d" _fc+1 ) _1 + o(B") such vectors w in cr. 



The number of such matrices [A'\v\ is then, up to an error of order o(B 



n(k— l)+n 



(2B) 



i(fc-l)+r, 



(C(n) • ... • C(n - k + 2) • d" 



(C(n - fc + 1) • rf"- fc+1 ) 



Since n(k — 1) + n = fcn, the claim is correct. This argument can be continued as long as Proposition 
[5] can be applied, i.e., until k < m if m < n or k < n otherwise. This finishes the proof of the first 
statement of the proposition. 

Let us concentrate now on the second statement. There exists a nxn unimodular matrix U such 
that the first (n — 1) column of UA are in HNF. Clearly, if a = (UA) n ^ n then a = HNF (A) n ^ n , i.e., 
a = u ■ a, where u is the last row of U and a is the last column of A. For any cube a of side length 
2B and dimension n, we want to find the number of n-vectors a in cr such that u ■ a = a mod d. 
Since the entries of u are coprime, at least one is coprime to d, say Ui. For each (2B) n ^ 1 choices of 
atj in cr, j ^ i, there are ^ + o(£>) a, e cr such that UiOii = a — J2j^i u j a j mod d. In other words, 
the density of the a's is 4. The result follows by applying the same counting argument as before 
and by using the previous expression of the density of Adi,d2,...,d n -i- This finishes the proof of the 
proposition. □ 



Corollary 7 Let d\, d2, d n —x £ N*. The natural density of n x n integer matrices whose HNF 
has diagonal ^c?i, d 2) • ■ • j ^n-i) j j dct - g . ) * s 

(C(n)-C(n-l).--C(2)-df 

A rectangular n x m integer matrix (with n m) is called unimodular if the greatest common 
divisor of its full rank minors is 1. The natural density of unimodular rectangular n x m integer 
matrices, say with n =^ m, has been computed in [14] , with the weak definition of natural density 
presented in Section [5] Proposition [B] allows to extend the result to the stronger natural density 
defined in this article. With the material in hand, the proof is straightforward, since a n x m integer 
matrix with n > m is unimodular if and only if its HNF has only l's in the diagonal. 

Corollary 8 The set ofnxm unimodular integer matrices, with n > m, has a natural density equal 
to (C(n) • C(n - 1)... • C(n - m+ l)) -1 . 
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5 Applications 



5.1 Selection of Random Lattices in Cryptology 

In the following, we discuss the consequences of Proposition |6] above to the various shapes of lattice 
bases that arise in lattice based cryptology. 

An integer lattice £ is a discrete Z- module of dimension n in K m with C = 1b\ + . . . + Zb n , where 
bi 6 Z m and Vol (£) = det([&j • bj]^) 1 / 2 ^ 0. A matrix B whose row vectors bi are independent 
and generate £ is called a basis of the lattice. Any matrix B' = UB with U unimodular is a basis 
of C. We refer the reader to, e.g., [T6J Chapter 3] and [3D] for the use of lattices in cryptology. 
Several types of lattice bases naturally appear in lattice based cryptology. Among them, we find the 
knapsack n X (n + 1) bases (a), the NTRU 2n x 2n bases (b) and the so-called random n x n lattice 
basis (c). 

In-i x 
q 

(a) (b) (c) 

A direct consequence of the previous proposition is that the density of integer matrices A with 
HNF of the form (a) is 0. The density of integer matrices A with HNF of the form (c) is given 
by (C{n) ■ ■ ■ ■ ■ C(2)) ■ Since £( n ) converges rapidly towards 1, the above density converges rather 

fast to the limit d with d = (j\JL 2 CO')) = 0.43575707677.... This translates into the facts that 
the random lattice bases of type (c) have a positive density in the set of lattices with corresponding 
dimension. The strict positivity of this density has been know since the work of Goldstein and Mayer 
[7] (see also [T] for an elementary proof). This density being equal to d, this shows that the process 
of selecting random lattice by selecting random row matrices of type (c) and large determinant q 
covers almost 44% of all possible cases of randomly looking matrices. 

In the case of NTRU bases (b), q = 2 s , where s is a small integer and Proposition |BJ suggests that 
the density of such lattice bases is roughly equal to d • 2~ N , with N — ^s. Here again, the density 
is strictly positive, but much smaller than in the random case (c). 

5.2 Distribution of gcd(det([A|x], det[j%])) 

Using the weak notion of density presented in Section [2J Hafncr, Sarnak and McCurley have com- 
puted the probability that two randomly looking n x n matrices are coprime [8] . The situation where 
the randomly looking matrices differs in one column only turns out to be interesting as well. 

Let A be a randomly looking nx(n-l) integer matrix and x, y be two randomly looking n- vectors. 
The distribution of the greatest common divisor g — gcd(det([A|x], detL4|y])) has been used in order 
to predict the behavior of fast algorithms that compute the HNF of an integer matrix, see [THl [TS] . 
Miccacio and Warinschi [15] notice that g is "typically very small for randomly chosen matrices" , and 
Pernet and Stein |18j , based on numerical simulation, provide an histogram of the distribution of the 
<?'s. We propose here to exactly compute this distribution based on the natural density distribution 
of Proposition [6] Suppose diag(HNF(A)) = (di, . . . , d„_i), with UA = HNF (A), U unimodular. 
Then 

g = gcd(det(L4|x],det[A|2/])) = gcA{Aet{[UA\Ux\,A^[UA\Uy])) 
= \\ di ■ gcd(w • x, u ■ y) 

i=l 

where u is the last row of U and u ■ x (resp. u ■ y) is the scalar product of u and x (resp. y). Note 
that since U is unimodular, we have gcd(u.;) = 1. The natural distribution of gcd(u ■ x,u ■ y) in such 
a case can be computed as follows. The reader will readily check that for any given modulus t, the 
distribution of (u ■ x mod t,u ■ y mod t) is uniform in (Z/iZ) 2 . This means that the proportion of 
pairs (u-x,u-y) that are divisible by d is d~ 2 , and among them, the proportion of pairs ((u-x) /d, (u ■ 
y)/d) that are not (0, 0) modulo a finite set of prime P is ripeP ^ — V 1 " 2 - Since gcd(w ■ x, u ■ y) = d if 



[In x ] 



I, 
On 



Hi, 
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and only if d\u ■ x and d\u ■ y, and for each prime p, p cannot divides ^ and ^ at the same time, 
it appears that the proportion of pairs (x, y) such that this is true is given by the limit 



pGP 

This heuristic approach can be made rigorous by using the methods used in Section [2] and the 
localization methods presented in |14j . Finally, the natural density D n (g) of n x (n — 1) integer 
matrices A and n-vectors x,y such that g — gcd(det([A\x],det[A\y])) is given by 

Dni9) = C(2MlL 2 C(fc) di .5 =9 dr.,,: '.....,/;; ^ ,.,/>• (3) 

If <j-k{g) = Y^d\gd~ k > then using the Dirichlet's convolution product * of arithmetic functions, we 
obtain 

Dn = C(2)-nLc(fc) ' (f7 " 1 * ^ *-*°^*°-** a_ 2 ) . 

Since the Dirichlet series associated to a-k is C( s + ' C( s ) ( see e -g- [22]), i-e., S 9 >i " gs 9 ^ — 
C(s) • C( s + the Dirichlet series associated to D n is given by 

g— -<«•» ■— -n— • "w* 1 - 

If we write /„ = C(2) • Ylk=2 C(&) ' ^n, Equation ([3]) above shows that the arithmetic function /„ is 
multiplicative, i.e., f n (gh) = f n {g) ■ f n (h) when gcd(g, h) = 1. It is therefore sufficient to compute 
fn(p a ) for p £ P, a > 1 in order to determine D n explicitly. Equation ([3]) with d% = p l gives 



i=0 ^ 

together with fi(p a ) — -^s- Based on this recurrence relation, we can compute /„ for the first value 
of n, e.g., f2(p a ) — ^t^- and prove that f n converges rapidly to a limit function / that satisfies 

m = 1 ' m = ¥¥^)> fip) = pHp-mp + D 

and in general for all a > 3, 

1 a 2a — 1 3a — 3 5a — 7 



f(p a ) 
The first values of 



p2a p2a-\-l p2a-\-2 p2ce+3 p2a-\-4 \p2a-\-5 



-1 



D(g) = lim D n (g) = lim C(2) • [] C(*) /»(») - 77^ ' /G?)> 



where d is the constant defined in Section 15711 are given via 

/(2) = f,/(3) = l ) /(4) = g,/(5) = A i/(6) = ^, /(7) = _^. 

Numerical simulation showed that already for small dimension n, say n > 5, the above values of 
D give very good approximations of the density D n . We end up this section by noticing that 
even though the above remark of Miccancio is true, the expected size of gcd(det([A|a;], det[A|y])) is 
unbounded. Indeed, the real numbers D(g), g G N*, define a probability distribution on N*, i.e., 
S 5 eN* D(g) = 1 and since D(p) > C/p 2 for some C > and X^epV-P = oo, the expectation of 
the positive integers under this distribution law is X1 s gn* ff-^(ff) > SpgpC/P = 00 ■ Notice that 
D(l) = = 0.266014... which is not far from 30%, as noted in [15]. 
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6 Conclusion 



Numerical experiments indicate that for randomly looking integer matrices, their Hermite normal 
forms are not uniformly distributed among the upper triangular matrices. The frequency of ap- 
parition of the different diagonals is highly structured. In this paper, we explain this phenomenon, 
and we exactly compute these frequencies in terms of natural density. On the way, we define a 
multidimensional extension of the usual natural density over N. We use this analysis in order to 
shed light on the following two different situations where the expected form of the HNF of randomly 
looking matrices play a role. First, the densities of three types of lattice bases that naturally appear 
in lattice based cryptology has been computed. Second, a probability distribution over the positive 
integer appearing in some HNF algorithms has been explicitly evaluated. 
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